How-to

Run a playbook headless

For CI, cron, and long-running jobs. Simulate first, sign for enforcement, and export attestations for auditors.

1
Write a JSON playbook (see packages/bridge/examples/). Only steps with autoApply: true execute unattended; the rest dry-run and log as needs-approval.
2
Preview verdicts first — no side effects, prints per-step risk and whether it would apply.
```
aarmos simulate --playbook path.json --json
```

Optional signing.

aarmos playbook keygen
aarmos playbook sign --playbook path.json --key .aarmos/keys/playbook.key.pem
# Enforce at runtime:
aarmos run --playbook path.json --enforce-signatures --trusted-pubkey <b64u>

4
Run the loop. Every action appends a hash-chained receipt; a --kill-switch file present at tick halts the loop; the rolling ceiling caps applied actions per hour.
```
aarmos run --playbook path.json \
  --receipts .aarmos/avar/ \
  --kill-switch .aarmos/stop \
  --max-per-hour 60
```
5
Destructive verbs (kubectl delete/drain, git push --force, Jira DELETE /issue/{id}) always force approval unless the step sets acknowledgeDestructive: true on a signed playbook. Runtime enforcement, not just lint.

Export evidence for auditors. Re-compute rootHash and check the signature offline.

aarmos attest --since 24h --sign-key <pem> --out audit.attest.json
aarmos verify audit.attest.json